PT-2004-1094 · Webmin+1 · Webmin+1

Keigo Yamazaki · Published 2004-06-18 · Updated 2017-07-11 · CVE-2004-0583

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webmin version 1.140 Usermin versions prior to 1.070-r1

Description The issue concerns the account lockout functionality, which does not properly parse certain character strings. This allows remote attackers to perform brute force attacks to guess user IDs and passwords. Multiple vulnerabilities in the Usermin package can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For Webmin version 1.140, update to a version that addresses the account lockout functionality issue. For Usermin versions prior to 1.070-r1, update to version 1.070-r1 or later to resolve the multiple vulnerabilities. As a temporary workaround, consider restricting access to the account lockout functionality until a patch is available.

Fix

Related Identifiers

BDU:2015-09452

CVE-2004-0583

DSA-526

Affected Products

Usermin

Webmin

References · 13

• http://securityfocus.com/bid/10474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0583 · Security Note
• https://bdu.fstec.ru/vul/2015-09452 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200406-15.xml · Vendor Advisory
• http://securityfocus.com/bid/10523 · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:074 · Vendor Advisory
• http://debian.org/security/2004/dsa-526 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200406-12.xml · Vendor Advisory
• http://lac.co.jp/security/csl/intelligence/SNSadvisory_e/75_e.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16334 · Note
• http://security.gentoo.org/glsa/glsa-200406-15.xml · Note
• http://marc.info/?l=bugtraq&m=108737059313829&w=2 · Note
• http://webmin.com/changes-1.150.html · Note